Virtual management network construction method and system in network target range

Abstract

The invention discloses a virtual management network construction method and system in a network target range. The method comprises the following steps: creating an external management network switch and an external core router; creating an internal service network switch of the topology instance; internal management network switches of the topology instance are created, each internal service network switch corresponds to one internal management network switch, and each internal management network switch corresponds to one virtual configuration acquisition agent node and one flow generator; creating an internal core router according to the number of nodes accessed by the internal management network switch; a port where the internal core router and the external core router are connected starts the SNAT, and the internal management network switch sets an ACL rule. According to the invention, the signaling flow is completely separated from the direct service flow network route of the service node in the target range topology instance, the receiving and responding efficiency of the signaling flow is improved, and the load balancing is realized.

Description

Technical Field

[0001] The invention relates to a method and system for constructing a virtual management network in a network target range, and belongs to the technical field of network security. Background Art

[0002] The network range is a simulation of a real network environment based on virtualization technology. It serves as a platform to support cyberspace security technology verification, network weapons and equipment testing, attack and defense confrontation exercises, and network risk assessment. After a certain topology in the range is built, it is also necessary to perform network configuration, information collection, traffic generation and other management operations on the virtual machine instances in the topology. These operations require the use of a pre-established virtual management network to achieve the signaling traffic in the external network to reach the specified internal virtual machine. The existing network range management operations have the following deficiencies:

[0003] 1. The network routing of signaling traffic used for management operations is not completely independent from the network routing of business traffic between topology instance nodes. Business traffic between instance nodes will affect the reception and response of signaling traffic, which may easily cause abnormal execution of management operations.

[0004] 2. Topology instance nodes can attack the range platform through the virtual management network, and abnormal traffic can be sent to the range platform, which can easily cause instability of the range platform.

[0005] 3. The virtual management network does not perform load balancing for large-scale networks, and the reception and transmission of signaling traffic are prone to single point failures, causing abnormal execution of management operations. Summary of the invention

[0006] Purpose of the invention: In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a method and system for constructing a virtual management network in a network range, supporting the routing of signaling traffic for management operations sent by a range platform connected to an external network to specific topology instance nodes, completing various node instance management operations performed after the topology instance is constructed, and realizing complete separation of signaling traffic and business traffic network routing directly between business nodes in the range topology instance, thereby improving the efficiency of signaling traffic reception and response and realizing load balancing.

[0007] Technical solution: To achieve the above-mentioned invention object, the present invention adopts the following technical solution:

[0008] A method for constructing a virtual management network in a network range comprises the following steps:

[0009] Create an external management network switch and an external core router; the range platform and the external core router are connected to the external management network switch, and the external core router is used for routing between the management network inside the topology instance and the external range platform network;

[0010] Create a business network switch inside the topology instance. Each business network switch corresponds to an independent business subnet inside the topology instance. The network segment of the business subnet is randomly selected from the preset range.

[0011] Create an internal management network switch for a topology instance, each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations; the internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator; the network segment of each internal management network switch is calculated according to the network segment where the corresponding internal business network switch is located; when creating a virtual business node in each topology instance, it is necessary to access the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch;

[0012] Creating an internal core router according to the number of nodes accessed by the internal management network switch, and connecting the internal core router to the external core router;

[0013] The port connecting the internal core router and the external core router opens SNAT, the virtual configuration collection agent node and the traffic generator set the default route, and the gateway is the port IP connecting the internal core router and the external core router;

[0014] The internal management network switch sets ACL rules to only allow internal proxy nodes to communicate with the range platform.

[0015] As a preferred method, a random algorithm for a service subnet to obtain a network segment is as follows:

[0016] Using Set <e>Record the subnet value that has been assigned to the current topology, Lock <Set <e>>Assign locks to the business subnet of the topology instance;

[0017] Determine the current network subnet value Vcidr based on the value obtained by the random function;

[0018] Waiting to acquire lock;

[0019] Check Set <e>Whether to include the current network subnet value Vcidr. If included, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <e>middle;

[0020] Add Vcidr to Set <e>After the middle, release the lock;

[0021] The network segment of the current service subnet is "A."+IntToStr((Vcidr>>8)&0xFF+128)+".."+IntToStr(Vcidr&0xFF)+".."+"0 / 24"; A is a preset fixed value.

[0022] Preferably, if the network segment corresponding to a service network switch is Abc0 / 24, then the network segment of the corresponding internal management network switch is A.(b-128).c.0 / 24.

[0023] As a preferred method, the algorithm for creating an internal core router according to the number of nodes connected to the internal management network switch is as follows:

[0024] Using Set <n>Stores the number of nodes connected to each internal management network switch, using Map<M,I> Record the mapping relationship between the internal management network switch and its internal core router tag. The current internal core router is marked as R, with an initialization value of 0. The current total number of nodes is marked as C, with an initialization value of 0. Assume that a fixed T-stage access node is assigned an internal core router.

[0025] Iterating over a Set <n>, for one of the elements Nx, make the following judgment:

[0026] If Nx > T / 2, Map<M, I> records key = x, value = R; R = R + 1;

[0027] If Nx < T / 2, C = C + Nx, if C < T, Map<M, I> records key = x, value = R; if C > T, Map<M, I> records key = x, value = R + 1; C = 0, R = R + 1.

[0028] Preferably, when connecting the internal core router and the external core router, allocate the network segments occupied by the connection lines according to the following algorithm:

[0029] Use the set Set <r>Record the connection subnet value that has been allocated to the current range platform, Lock <Set <r>>Assign locks to the subnet segments of the range platform;

[0030] Determine the current network subnet value Vcidr based on the value obtained by the random function;

[0031] Waiting to acquire lock;

[0032] Check Set <r>Whether to include the current network subnet value Vcidr. If included, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <r>middle;

[0033] Add Vcidr to Set <r>After the middle, release the lock;

[0034] The network segment of the current connection is "B." + IntToStr((Vcidr>>14)&0xFF)+"."+

[0035] IntToStr((Vcidr>>6)&0xFF)+".”+IntToStr((Vcidr&0xFC)<<2)+" / 30"; where B is a preset fixed value.

[0036] As a preferred embodiment, the virtual configuration collection agent node and the traffic generator actively request the range platform to obtain the task order generated by the user management operation through regular polling and reverse connection mechanism, specifically including:

[0037] The internal core router turns on SNAT, and the network where the port connected to the external core router is located is the external network of SNAT, and the other ports are all internal networks;

[0038] Each internal proxy node is set with a default route, and the gateway is an internal core router connected to the internal management network switch to which it is connected, and the internal proxy node refers to a virtual configuration collection proxy node and a traffic generator;

[0039] Internal proxy nodes send heartbeats to the range platform at regular intervals, carrying the unique ID of the internal management network switch to which they belong and their own proxy type;

[0040] When the range platform receives a heartbeat request from the internal proxy node of the topology instance, it will obtain the ID and proxy type carried in the request. If a user operates on the range platform and issues a task to the internal node of the specified range instance, the range platform will generate a task order.

[0041] Preferably, the task list fields include the node ID, the node management IP, the unique ID of the internal management network switch to which the node is connected, the agent type actually executing the management operation, the content of the management operation execution and the task list status.

[0042] A virtual management network construction system in a network range, comprising:

[0043] A pre-creation module is used to create an external management network switch and an external core router; the range platform and the external core router are connected to the external management network switch, and the external core router is used for routing between the management network inside the topology instance and the external range platform network;

[0044] The business network switch creation module is used to create a business network switch inside the topology instance. Each business network switch corresponds to an independent business subnet inside the topology instance. The network segment of the business subnet is randomly selected from a preset range.

[0045] An internal management network switch creation module is used to create an internal management network switch for a topology instance, each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations; the internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator; the network segment of each internal management network switch is calculated based on the network segment where the corresponding internal business network switch is located; when creating a virtual business node in each topology instance, it is necessary to access the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch;

[0046] An internal core router creation module, used to create an internal core router according to the number of nodes accessed by the internal management network switch, and connect the internal core router with the external core router;

[0047] A rule configuration module is used to enable SNAT on the port connecting the internal core router and the external core router, to set a default route for the virtual configuration collection agent node and the traffic generator, and the gateway is the port IP connecting the internal core router and the external core router; and the internal management network switch sets ACL rules to only allow the internal agent node to communicate with the range platform.

[0048] A computer system includes a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor. When the computer program / instruction is executed by the processor, the steps of a method for constructing a virtual management network in a network range are implemented.

[0049] A computer program product includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the method for constructing a virtual management network in a network range are implemented.

[0050] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0051] 1. The present invention designs an independent internal virtual management network in the network range, which completely separates the signaling traffic for management operations from the business traffic network routing of the business nodes in the range topology instance. It ensures that the management signaling traffic has an independent network routing, improves the efficiency of receiving and responding to the signaling traffic of management operations, and avoids the unpredictable business traffic affecting the normal operation of the range platform management operation.

[0052] 2. The virtual configuration collection agent node and traffic generation instrument in the internal virtual management network designed by the present invention adopts periodic polling and reverse connection mechanism to obtain the management operation information issued by the range platform, combined with the SNAT mechanism of the internal core router, to avoid the internal management network directly connecting to the external pre-created external core router, saving the network segment that the external core router needs to connect to, and reducing the routing and forwarding pressure of the external core router. Improve the efficiency of receiving and responding to the signaling traffic of management operations.

[0053] 3. The present invention creates a corresponding internal virtual management network according to the number of internal business management networks, effectively achieving the purpose of load balancing of signaling traffic for management operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 The figure is a flow chart of a method according to an embodiment of the present invention.

[0055] Figure 2 A result diagram is constructed for a topology example illustrated in an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0057] like Figure 1 As shown, a method for constructing a virtual management network in a network range disclosed in an embodiment of the present invention mainly includes the following steps: first, creating an external management network switch and an external core router, the range platform and the external core router are connected to the external management network switch, and the external core router is used for routing between the management network inside the topology instance and the external range platform network; then, creating a business network switch inside the topology instance, each business network switch corresponds to an independent business subnet inside the topology instance; the network segment of the business subnet is randomly selected from a preset range; then, constructing the internal management network of the topology instance, specifically including:

[0058] First, create an internal management network switch for a topology instance, each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations; the internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator; the network segment of each internal management network switch is calculated according to the network segment where the corresponding internal business network switch is located; when creating a virtual business node in each topology instance, it is necessary to access the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch;

[0059] Next, according to the number of nodes connected to the internal management network switch, an internal core router is created and connected to the external core router;

[0060] Then, SNAT is enabled on the port connecting the internal core router and the external core router, and the default route is set for the virtual configuration collection agent node and the traffic generator, and the gateway is the port IP connecting the internal core router and the external core router;

[0061] Finally, the internal management network switch sets ACL rules to only allow internal proxy nodes to communicate with the range platform.

[0062] The method for constructing a virtual management network in a network range described in an embodiment of the present invention can separate the network routing of signaling traffic and business traffic between topology instance nodes while realizing that the range platform can normally send signaling traffic to the topology instance node, and at the same time add network firewall rules to realize traffic control between the instance nodes inside the topology and the range platform. At the same time, according to the number of subnets of different topologies, different numbers of management networks are created to realize load balancing of management network signaling traffic and avoid global failure caused by a single point.

[0063] Below Figure 2 Taking the topology example 1 shown in the figure as an example, the detailed design and implementation of the solution of the present invention are specifically described. Figure 2 As shown, in topology instance 1, a total of 7 nodes, including virtual node a, business network switch a, virtual node b, virtual business network router, business network switch b, virtual node c, and virtual node d, are business nodes of topology instance 1, that is, nodes that can be directly viewed by the user of the range platform when viewing topology instance 1. Internal management network switch a, internal management network switch b, and internal core router are management network routes corresponding to the business network of topology instance 1. Virtual configuration collection agent a and virtual configuration collection agent b are configuration and collection agent virtual corresponding to the management network mapped by the business network in topology instance 1, which are used for configuration and collection management operations of all business nodes connected to the current internal management network switch. In addition, each business network switch will be connected to a traffic generator trex, which is used to perform traffic generation and other traffic management operations on all business nodes connected to the current business network switch. All these internal management network switches will be uniformly connected to an internal core router. The internal core router will be connected to the external core route created in advance. At the same time, SNAT is enabled to support all virtual configuration collection agents and traffic generator trex to actively report collection data, query configuration and traffic operations to the external range platform.

[0064] The following describes in detail how the virtual management network is constructed along with the topology instance, and how the created virtual management network implements the signaling traffic of the target range platform management operation to be sent to the virtual configuration collection agent and traffic generating instrument TREX inside the target range instance.

[0065] Step 1. Create a predefined external management network switch and external core router.

[0066] When installing the range platform, we will pre-build a fixed external network switch - the external management network switch, and the virtual machine deployed with the range platform will be fixedly connected to the external management network switch. At the same time, an external core router will be pre-created to route between the management network inside the topology instance and the external range platform network. Therefore, the external management network switch will also be pre-fixedly connected to the external core router.

[0067] Step 2. Create a topology instance internal business network switch.

[0068] Let's take the business network in topology example 1 in the figure as an example. We will first create business network switch a and business network switch b. Business network switch a and business network switch b are two independent subnets. The values ​​of these two subnets are randomly selected from the 32768 subnets from 10.128.0.0 / 24 to 10.255.255.0 / 24 by default. The random algorithm for a business subnet to obtain a network segment is as follows:

[0069] Step 2.1 Set <e>Record the subnet value that has been assigned to the current topology, for example, {1,2}.

[0070] Lock <Set <e>>Assign a lock to the business subnet of topology instance 1. When setting cidr for all business subnets, you need to obtain Lock first <Set <e>>Lock.

[0071] Step 2.2 calls the Random function, inputs the seed as the current time, and obtains a floating point number n in the range [0,1].

[0072] Step 2.3 The current network subnet value Vcidr is 32768 multiplied by the random number n obtained in the previous step, and then rounded down.

[0073] Step 2.4 Waiting for Lock to be acquired <Set <e>>Lock.

[0074] Step 2.5 Check Set <e>Whether to include the current network subnet value Vcidr, if included, Vcidr =

[0075] Vcidr+1, until Vcidr no longer exists in Set <e>For example, if Vcidr is randomly assigned a value of 1 for the first time, 1 is already included in Set <e>If Vcidr=Vcidr+1=2, 2 is still included in Set <e>In the example, Vcidr = Vcidr + 1 = 3. 3 is not in Set <e>If Vcidr=3, you can proceed to the next step.

[0076] Step 2.6 Add Vcidr to Set <e>After the middle, release the Lock <Set <e>>Lock.

[0077] Step 2.7 The network segment of the current service subnet is "10." + IntToStr((Vcidr>>8)&0xFF+128)+"." + IntToStr(Vcidr&0xFF)+"." + "0 / 24". That is, the first segment of the IPv4 address is fixed to 10, the value of the second segment is Vcidr shifted right by 8 bits, and then ANDed with 0xFF and then added to 128, the value of the third segment is Vcidr and 0xFF ANDed, the value of the fourth segment is fixed to 0, and the mask is fixed to 24 bits.

[0078] Step 3. Build the internal management network of the topology instance.

[0079] Step 2 has created all the business network switches of the topology instance. The network segment where the switch is located has a 24-bit mask by default, which can support up to 254 hosts. A large topology instance will create hundreds or even thousands of business network switches to support the access of hundreds of thousands of hosts. In order to realize the information collection, network configuration delivery and traffic generation of the host, it is impossible for the range platform to directly connect these hosts to the same internal management subnet. First, if they are all connected to the same internal management subnet, these machines will first send ARP broadcast packets. The internal management subnet carries huge traffic pressure. At the same time, there are too many hosts in the internal management subnet, and the ARP cache table of each host is too large. Secondly, the range platform needs to send management signaling such as host network configuration, information collection, and traffic delivery through the internal management subnet. All signaling traffic depends on the same internal management subnet, which is easy to cause network congestion and signaling traffic sending and receiving failure. At the same time, all hosts are connected to the same internal management subnet, and hosts can communicate directly through this subnet, which destroys the logic of the current topology instance business network. In this regard, the following internal management network construction plan was designed specifically.

[0080] Step 3.1 Each internal business network switch corresponds to an internal management network switch, each internal management network switch corresponds to a virtual configuration collection agent node, and each internal management network switch corresponds to a traffic generator trex. The specific steps are as follows:

[0081] Step 3.1.1 Calculate the network segment of the internal management switch based on the network segment where the internal business network switch is located. According to the internal business switch network calculation algorithm described in step 2, it can be known that the network segment of each business network is different. And the first 9 bits of the IPv4 network segment of all business networks are fixed, that is, the value of the first 8 bits adds up to 10, and the 9th bit is 1. If the network segment corresponding to a business network switch is 10.bc0 / 24, then the network segment of the corresponding internal management network switch is 10.(b-128).c.0 / 24. That is, if a business network switch is located in a network segment, in order to obtain the network segment of the corresponding internal management network switch, it is only necessary to flip the 9th bit of the network where the business network switch is located from 1 to 0, and keep the other 23 bits the same, and the mask is also 24 bits.

[0082] Step 3.1.2 When creating a virtual business node in each topology instance, at least two internal network switches need to be connected, one is the internal business network switch, and the other is the internal management network switch corresponding to the internal business network switch. At the same time, the default route set for the virtual business node should be the route of the business network where it is located, and there is no need to set a route for the internal management network. Because the virtual business node will only communicate directly with the virtual configuration collection node and the traffic generating instrument TREX in the internal management network. Their direct communication is within the same LAN and does not require any routing. For example, the virtual node A in the topology instance 1 in the figure only needs one default route, and the gateway is the IP address of the port where the virtual business router accesses the business network switch A.

[0083] Step 3.1.3 Create a virtual configuration collection agent node for each internal management network switch. This node will only connect to its corresponding internal management network switch and is responsible for the network configuration operations of all business nodes connected to the internal management network switch. For example, in topology instance 1, we need to set the DNS setting of the network card that connects to the internal business network switch for virtual node a to 1.1.1.1. The target range platform cannot directly connect to the specified business node in the specified topology instance and issue the configuration. It completes the network configuration by issuing the network configuration information of the business node through the virtual configuration collection agent node in the topology instance. For the detailed implementation of the virtual configuration collection agent system, please refer to the patent application document CN117857290A "Automatic configuration method and system based on configuration agent in network target range".

[0084] Step 3.1.4 Each internal management network switch creates a traffic generator trex, which will simultaneously access the current internal management network switch and the internal business network switch corresponding to the internal management network switch, and is responsible for executing the actual traffic generation service for all service nodes connected to the internal business network switch. For a detailed description of the specific traffic generation service, please refer to the patent document CN117749639B "A method and system for automatically generating network target range traffic".

[0085] Step 3.2: Create an internal core router based on the number of nodes connected to the internal management network switch, and connect the internal core router to the external core router that has been pre-established. The specific steps are as follows:

[0086] Step 3.2.1 Create a reasonable number of internal core routers based on the number of access nodes of the internal management network switch to load balance the signaling traffic between the range platform and the virtual agent accessed by the internal management network switch. Now by default, one internal core router is allocated for every 300 access nodes.

[0087] The specific algorithm is as follows:

[0088] Step 3.2.1.1 Assume that there are currently internal management network switches a, b, c, d, and e, and the number of nodes connected to them is Na, Nb, Nc, Nd, and Ne, respectively. Use Set <n>The current total number of nodes is marked as C, and the initial value is 0. Each internal core router connected to the internal management network switch is marked as Ia, Ib, Ic, Id, and Ie.<M,I> Record the mapping relationship between the internal management network switch and its internal core router tag. The current route tag is R and the initialization value is 0. By default, the fixed T station access node is assigned an internal core router. The default value of T is 300.

[0089] Step 3.2.1.2 Traverse Set <n>For the value Nx of one of the elements, perform the following operations

[0090] Step 3.2.1.3 If Nx > T / 2, Map<M, I> records key = x, value = R. R = R + 1.

[0091] Step 3.2.1.4 If Nx < T / 2, C = C + Nx. If C < T, Map<M, I> records key = x, value = R. If C > T, Map<M, I> records key = x, value = R + 1. C = 0, R = R + 1.

[0092] After executing the above algorithm, ensure that the total number of service nodes connected under each internal management network router accessed by each internal core router does not exceed T. The number of internal core routers to be created is R. The relationship between each management network router and the internal core routers to be accessed can be queried from Map<M, I>.

[0093] Step 3.2.2 When an internal core router is connected to an external core router, it is necessary to reasonably allocate the network segments occupied by the connection lines.

[0094] The subnet mask of the network segment occupied by each connection line between an internal core router and an external core router is 30 bits. The network segments need to be non-repetitive among all topology instances. That is, before obtaining the allocated network segment, it is necessary to obtain a unique lock for the range platform first. And the first 8 bits of the network segment value are defaulted to 99. That is, the range of the network segment value is from 99.0.0.0 / 30 to 99.0.0.252 / 30. That is, there are 2 to the 22nd power, 4194304 subnets to choose from. The specific algorithm for obtaining the subnet network segment is similar to Step 2 mentioned above.

[0095] Step 3.2.2.1 Set <r>Record the connection subnet value that has been allocated to the current range platform, for example {1,2}. <Set <r>>Assign a lock to the subnet segment of the range platform When setting the subnet cidr of the connection line between all internal core routers and external core routers, you need to obtain Lock first Lock.

[0096] Step 3.2.2.2 calls the Random function, inputs the seed as the current time, and obtains a floating point number n in the range [0,1].

[0097] Step 3.2.2.3 The current network subnet value Vcidr is 4194304 multiplied by the random number n obtained in the previous step, and then rounded down.

[0098] Step 3.2.2.4 Waiting for Lock to be acquired Lock.

[0099] Step 3.2.2.5 Check Set <r>Whether to include the current network subnet value Vcidr. If included, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <r>For example, if Vcidr is randomly assigned a value of 1 for the first time, 1 is already included in Set <r>If Vcidr=Vcidr+1=2, 2 is still included in Set <e>In the example, Vcidr = Vcidr + 1 = 3. 3 is not in Set <r>If Vcidr=3, you can proceed to the next step.

[0100] Step 3.2.2.6 Add Vcidr to Set <r> After the middle, release the Lock< / r> < / r> < / e> < / r> < / r> < / r> Lock.

[0101] Step 3.2.2.7 The network segment of the current connection is "99." + IntToStr((Vcidr>>14)&0xFF)+"." + IntToStr((Vcidr>>6)&0xFF)+"." + IntToStr((Vcidr&0xFC)<<2)+" / 30". That is, the first segment of the IPv4 address is fixed to 99, the value of the second segment is Vcidr shifted 14 bits to the right and then ANDed with 0xFF, the value of the third segment is Vcidr shifted 6 bits to the right and then ANDed with 0xFF, the value of the fourth segment is Vcidr first ANDed with 0xFC and then shifted 2 bits to the left, and the mask is fixed to 30 bits.

[0102] Step 3.3: SNAT is enabled on the port connecting the internal core router and the external core router. The virtual configuration collection agent node and the traffic generator trex set the default route, and the gateway is the port IP connecting the internal core router and the external core router. The virtual configuration collection agent node and the traffic generator trex actively request the range platform to obtain the task order generated by the user management operation through regular polling and reverse connection mechanism.

[0103] After the above steps 3.1 and 3.2, the virtual management network has been initially established. However, the range platform cannot ping the virtual configuration collection agent node and the traffic generator trex in the topology instance. This is because the range platform cannot route to the network inside the topology instance. A range platform will create many topology instances, and the management network segments inside different topology instances will be repeated. Therefore, if you start from the range platform and give a virtual configuration collection agent node IP, you cannot confirm which internal core router you need to pass through to reach this IP.

[0104] Therefore, the virtual configuration collection agent node and traffic generator trex node inside the topology instance need to use reverse connection to communicate with the external range platform. The specific configuration process is as follows:

[0105] Step 3.3.1 The core router inside the topology example has SNAT enabled. The network where the port connected to the external core router is located is the external network of SNAT. All other ports are internal networks.

[0106] In step 3.3.2, the term internal proxy node is used to uniformly refer to the virtual configuration collection proxy node and traffic generator trex within the topology instance.

[0107] Step 3.3.2 Set a default route for each internal proxy node, with the gateway being the internal core router connected to the internal management network switch to which it is connected.

[0108] Step 3.3.3 Each internal proxy node needs to set a scheduled task to send a heartbeat to the range platform every T time (T defaults to 60s), and carry the unique ID of the internal management network switch to which it belongs, mgmtNetworkId, and its own proxy type, which is divided into CONFIG and FLOW. CONFIG represents the virtual configuration collection agent, and FLOW represents the flow generator trex.

[0109] Step 3.3.4 The range platform receives the heartbeat request from the internal proxy node of the topology instance and obtains the bizNetworkId and proxy type carried in the request. If a user operates on the range platform, the network configuration information is sent to the specified internal node of the range instance. For example, for virtual machine node 1 in topology instance 1, configure its port g0 / 1dns to 1.1.1.1. The range platform will generate a task list, and the task list fields are designed as shown in the following table:

[0110] Table 1: Task Order Fields

[0111]

[0112]

[0113] The specific steps are as follows:

[0114] Step 3.3.4.1 When the range platform receives a heartbeat request from a proxy node within a topology instance, it obtains the mgmtNetworkId and proxy type carried in the request.

[0115] Step 3.3.4.2 Then the range platform will query the generated task order. If the node_access_mgmt_network_id and proxy_type of the task order are consistent with the mgmtNetworkId and proxy type in the request, and the state of the task order is 0, the task order will be returned as the response body to the corresponding request. At the same time, the state of the task order will be set to 1.

[0116] Step 3.3.4.2 After the internal proxy node receives the response to the heartbeat request, it can start to actually execute the operation task described in the task list proxy_content. For specific execution methods, please refer to "Automatic Configuration Method and System Based on Configuration Proxy in Network Range" and "A Method and System for Automatic Generation of Network Range Traffic". This invention only introduces how to construct a virtual management network to send signaling traffic.

[0117] Step 3.4 Set ACL rules on the internal management network switch to allow only the virtual configuration collection agent node and traffic generator trex in the internal management network to communicate with the range platform. The following uniformly uses internal agent nodes to refer to virtual configuration collection agent nodes and traffic generator trex. The specific rule settings are as follows:

[0118] Step 3.4.1 rejects all traffic packets of ipv4 protocol and ipv6 protocol, with priority 1001

[0119] Step 3.4.2 allows traffic packets whose source and destination IPs are the port IPs of the internal proxy node accessing the management network switch, with a priority of 1002, which is greater than the previous priority.

[0120] So far, we have completed the construction of the virtual management network, as well as the implementation of the current virtual management network construction, and the transformation of the reverse connection method required for the proxy node inside the topology instance to obtain the signaling traffic of the target range platform management operation.

[0121] Based on the same inventive concept, an embodiment of the present invention discloses a virtual management network construction system in a network range, including:

[0122] A pre-creation module is used to create an external management network switch and an external core router; the range platform and the external core router are connected to the external management network switch, and the external core router is used for routing between the management network inside the topology instance and the external range platform network;

[0123] The business network switch creation module is used to create a business network switch inside the topology instance. Each business network switch corresponds to an independent business subnet inside the topology instance. The network segment of the business subnet is randomly selected from a preset range.

[0124] An internal management network switch creation module is used to create an internal management network switch for a topology instance, each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations; the internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator; the network segment of each internal management network switch is calculated based on the network segment where the corresponding internal business network switch is located; when creating a virtual business node in each topology instance, it is necessary to access the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch;

[0125] An internal core router creation module, used to create an internal core router according to the number of nodes accessed by the internal management network switch, and connect the internal core router with the external core router;

[0126] A rule configuration module is used to enable SNAT on the port connecting the internal core router and the external core router, to set a default route for the virtual configuration collection agent node and the traffic generator, and the gateway is the port IP connecting the internal core router and the external core router; and the internal management network switch sets ACL rules to only allow the internal agent node to communicate with the range platform.

[0127] Based on the same inventive concept, an embodiment of the present invention discloses a computer system, including a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor. When the computer program / instruction is executed by the processor, the steps of the method for constructing a virtual management network in a network target range are implemented.

[0128] Based on the same inventive concept, a computer program product disclosed in an embodiment of the present invention includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the method for constructing a virtual management network in a network target range are implemented. < / r> < / r> < / n> < / n> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / r> < / r> < / r> < / r> < / r> < / n> < / n> < / e> < / e> < / e> < / e> < / e>

Claims

1. A method for constructing a virtual management network in a network range, characterized in that: The steps include: Create an external management network switch and an external core router; the range platform and the external core router are connected to the external management network switch, and the external core router is used for routing between the management network inside the topology instance and the external range platform network; Create a business network switch inside the topology instance. Each business network switch corresponds to an independent business subnet inside the topology instance. The network segment of the business subnet is randomly selected from the preset range. Create an internal management network switch for a topology instance, each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations; the internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator; the network segment of each internal management network switch is calculated according to the network segment where the corresponding internal business network switch is located; when creating a virtual business node in each topology instance, it is necessary to access the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch; Creating an internal core router according to the number of nodes accessed by the internal management network switch, and connecting the internal core router to the external core router; The port connecting the internal core router and the external core router opens SNAT, the virtual configuration collection agent node and the traffic generator set the default route, and the gateway is the port IP connecting the internal core router and the external core router; The internal management network switch sets ACL rules to only allow internal proxy nodes to communicate with the range platform.

2. According to the method for constructing a virtual management network in a network range according to claim 1, it is characterized in that: The random algorithm for a business subnet to obtain a network segment is as follows: Using Set <e>Record the subnet value that has been assigned to the current topology, Lock <Set <e> >Assign locks to the business subnet of the topology instance;< / e> < / e> Determine the current network subnet value Vcidr based on the value obtained by the random function; Waiting to acquire lock; Check Set <e>Whether to include the current network subnet value Vcidr. If included, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <e> middle;< / e> < / e> Add Vcidr to Set <e> After the middle, release the lock;< / e> The network segment of the current service subnet is "A."+IntToStr((Vcidr>>8)&0xFF+128)+".."+IntToStr(Vcidr&0xFF)+".."+"0 / 24"; A is a preset fixed value.

3. According to claim 2, a method for constructing a virtual management network in a network range is characterized in that: If the network segment corresponding to a business network switch is Abc0 / 24, then the network segment of the corresponding internal management network switch is A.(b-128).c.0 / 24.

4. According to a method for constructing a virtual management network in a network range according to claim 1, it is characterized in that: The algorithm for creating an internal core router based on the number of nodes connected to the internal management network switch is as follows: Using Set <n> Stores the number of nodes connected to each internal management network switch, using Map<M,I> Record the mapping relationship between the internal management network switch and its internal core router tag. The current internal core router is marked as R, with an initial value of 0. The current total number of nodes is marked as C, with an initial value of 0. Assume that a fixed T-stage access node is assigned an internal core router.< / n> Iterating over a Set <n> , for one of the elements Nx, make the following judgment:< / n> If Nx>T / 2, Map<M,I> Record key=x, value=R; R=R+1; If Nx < T / 2, C = C + Nx. If C < T, Map<M, I> records key = x, value = R; if C > T, Map<M, I> records key = x, value = R + 1; C = 0, R = R + 1.

5. According to claim 1, a method for constructing a virtual management network in a network range is characterized in that: When connecting the internal core router to the external core router, allocate the network segments occupied by the connection lines according to the following algorithm: Using Set <r>Record the connection subnet value that has been allocated to the current range platform, Lock <Set <r>> Allocate a lock for the subnet segment of the range platform; < / r> < / r> Determine the current network subnet value Vcidr according to the value obtained by the random function; Wait to acquire the lock; Check Set <r>Whether to include the current network subnet value Vcidr. If included, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <r>In; < / r> < / r> Add Vcidr to Set <r>After that, release the lock; < / r> The network segment of the current connection is "B." + IntToStr((Vcidr >> 14) & 0xFF) + "." + IntToStr((Vcidr >> 6) & 0xFF) + "." + IntToStr((Vcidr & 0xFC) << 2) + " / 30"; where B is a preset fixed value.

6. According to a method for constructing a virtual management network in a network range according to claim 1, it is characterized in that: The virtual configuration collection agent node and the traffic generator actively request the task list generated by the user management operation from the range platform through the regular polling and reverse connection mechanism, specifically including: The internal core router enables SNAT, and the network where the port connected to the external core router is located is the external network of SNAT, and other ports are all internal networks; Each internal proxy node sets the default route, and the gateway is the internal core router connected to the internal management network switch it accesses; The internal proxy nodes send heartbeats to the range platform regularly, carrying the unique ID of the internal management network switch they belong to and their own proxy types; When the range platform receives the heartbeat request of the internal proxy node of the topology instance, it will obtain the ID and proxy type carried in the request. If there is a user operating on the range platform and tasks are sent to the specified internal nodes of the range instance, the range platform will generate a task list.

7. The method for constructing a virtual management network in a network range according to claim 6, characterized in that: The fields of the task list include node ID, node management IP, the unique ID of the internal management network switch accessed by the node, the proxy type actually executed for the management operation, the content of the management operation executed, and the status of the task list.

8. A virtual management network construction system in a network range, characterized in that: Include: A pre-creation module for creating an external management network switch and an external core router; The range platform and the external core router are connected to the external management network switch. The external core router is used for routing between the management network inside the topology instance and the external range platform network; A business network switch creation module for creating business network switches inside the topology instance. Each business network switch corresponds to an independent business subnet inside the topology instance; the network segments of the business subnets are randomly selected from a preset range; An internal management network switch creation module is used to create an internal management network switch for a topology instance, each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations; the internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator; the network segment of each internal management network switch is calculated based on the network segment where the corresponding internal business network switch is located; when creating a virtual business node in each topology instance, it is necessary to access the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch; An internal core router creation module, used to create an internal core router according to the number of nodes accessed by the internal management network switch, and connect the internal core router with the external core router; A rule configuration module is used to enable SNAT on the port connecting the internal core router and the external core router, to set a default route for the virtual configuration collection agent node and the traffic generator, and the gateway is the port IP connecting the internal core router and the external core router; and the internal management network switch sets ACL rules to only allow the internal agent node to communicate with the range platform.

9. A computer system comprising a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor, characterized in that: When the computer program / instructions are executed by the processor, the steps of a method for constructing a virtual management network in a network range according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by the processor, the steps of a method for constructing a virtual management network in a network range according to any one of claims 1 to 7 are implemented.

Images